2011-01-12 Kenichi Ishibashi <bashi@google.com>
Reviewed by Kent Tamura.
M_formElementsWithFormAttribute not cleared when Node is moved to another document.
https://bugs.webkit.org/show_bug.cgi?id=51418
Calls unregisterFormElementWithFormAttribute() when form associated elements
are moved to another document.
Test: fast/forms/change-form-element-document-crash.html
* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::willMoveToNewOwnerDocument): Added.
* html/FormAssociatedElement.h: Added willMoveToNewOwnerDocument().
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::willMoveToNewOwnerDocument): Added.
* html/HTMLFormControlElement.h: Added willMoveToNewOwnerDocument().
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::willMoveToNewOwnerDocument): Added.
* html/HTMLObjectElement.h: Added willMoveToNewOwnerDocument().
* html/HTMLPlugInImageElement.h: Moves willMoveToNewOwnerDocument() to protected.
2011-01-12 Kenichi Ishibashi <bashi@google.com>
Reviewed by Kent Tamura.
M_formElementsWithFormAttribute not cleared when Node is moved to another document.
https://bugs.webkit.org/show_bug.cgi?id=51418
Added test for crash when moving form elements from one document to another.
* fast/forms/change-form-element-document-crash-expected.txt: Added.
* fast/forms/change-form-element-document-crash.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75675
268f45cc-cd09-0410-ab3c-
d52691b4dbfc